JP3210527B2 - Redundant computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a redundant computer system comprising a redundant system, and more particularly, to a sequential circuit capable of performing a scan test from the outside of each system, and a scan test of the sequential circuit. A plurality of sequential circuit elements having a built-in internal scan path forming a serial data path when performing the serial data path, and outputting serial data from the serial input terminal for inputting serial data to the internal scan path and the internal scan path. Computer system in which a plurality of sequential circuit elements having a serial output terminal are mounted.

[0002]

2. Description of the Related Art Conventionally, a computer which employs a configuration in which a system is made redundant and a result of operation is compared in order to provide a high reliability is required, for example, as shown in FIG.
There is a configuration in which 1, a2 and b1, b2 are further made redundant to form an a-system and a b-system. In such a computer system, a failure is detected by comparing the operation results of the duplicated systems a1, a2 and b1, b2, and a failure is detected from the redundant system (consisting of the systems a and b). By disconnecting the heavy systems a1, a2 or b1, b2, a system down is avoided and the system operation is continued.

In addition, for example, as shown in FIG. 5, there are three redundant systems a1, a2, and a3, and when a failure occurs, a majority decision is made by comparing the states of the three systems a1 to a3 to generate a failure. There is also a computer system that specifies a system that has been changed and continues processing.

[0004]

As described above, in a conventional computer system having a configuration in which the system is made redundant and the operation results are compared in order to require high reliability, in the case of a system in which a fault is detected by a duplex configuration, However, there is a problem that the amount of hardware increases because further duplication (totaling is quadruple) is required to specify a failure. Further, even in a computer system for detecting a failure and specifying a location of a failure by using the triple system, there is a problem that the amount of hardware also increases because the logical system must be tripled.

The present invention has been made in view of the above circumstances, and its object is to specify a system in which a failure has occurred in one of the systems while a simple system has a failure. It is an object of the present invention to provide a redundant computer system capable of performing degenerate operation only with a normal system.

Another object of the present invention is to provide a dual computer system capable of detecting a transient failure and operating in the dual system even when a temporary failure occurs in a simple dual system configuration. To provide.

[0007]

SUMMARY OF THE INVENTION The present invention has a built-in sequential circuit and an internal scan path, and has a serial input terminal for inputting serial data to the internal scan path and a serial input terminal for outputting serial data from the internal scan path. In a duplicated computer system in which a plurality of sequential circuit elements each having a serial output terminal are duplicated by first and second systems mounted thereon, and in a normal state, each system operates as a duplex system performing the same processing, An external scan path that is provided for each system and that connects each sequential circuit element in the corresponding system in multiple stages in a predetermined order via a serial input terminal and a serial output terminal; and a predetermined information handled in both systems. Comparing means for detecting that one of the systems has failed by comparing the Evacuation means for evacuation through the external scan path with the state of the sequential circuit of the introductory circuit element as the internal state of the system; and the internal state provided for each system and evacuation by the evacuation means of the corresponding system. and loading means for loading through campus, provided for each of the respective systems, and self-diagnosis means for performing a self-diagnosis of the system corresponding to the later saving operation completion of the saving means, when a failure occurs is detected by said comparing means, said The evacuation operation by the evacuation means of each system is started, and as a result of the self-diagnosis by the self-diagnosis means of each system following the evacuation operation, if one of the systems is normal, the load means of the normal system side Dual system management means for activating the load operation and performing the degenerate operation only by the normal system is provided.

Further, according to the present invention, when any of the systems is normal as a result of the self-diagnosis by the self-diagnosis means of each system, the dual system management means is replaced with a journal file management means provided for each system. The system is also characterized in that the system state restoring operation is started to return to the dual system. Here, the comparison
As a result of detecting the occurrence of a failure by the
When the stage starts the evacuation operation by the evacuation means of each of the above systems,
May invalidate the comparison function of the comparison means. This place
System by each journal file management means of each system
When starting the system state restoration operation and returning to the dual system,
Enables the column comparison function.

[0009]

In the above arrangement, when a failure is detected by the comparing means, the evacuation means of each system is activated by the dual system management means, and the state of the sequential circuit of each sequential circuit element in the corresponding system is changed. It is saved as an internal state of the system through an external scan path. At this time, the dual system management means
The comparison function of the comparison means can be invalidated.

When the evacuation operation by the evacuation means of each system is completed, the self-diagnosis means of each system is activated, and self-diagnosis of the own system is performed. The self-diagnosis result of each self-diagnosis unit is notified to the dual system management unit.

The dual system management means reconfigures the system based on the self-diagnosis results of the self-diagnosis means of each system.
If it is determined from this diagnosis result that one of the systems is normal, the load operation by the normal system-side load means is started.

Then, the state of each sequential circuit element on the normal system side is restored to the state at the time of failure detection by the comparing means via the external scan path, and the degenerate operation is performed only by the normal system.

When the dual system management means determines that all the systems are normal, the dual system management means determines that the failure detected by the comparison means is transient, and the dual system management means Activate the state restoration operation . This
At this time, the dual system management means starts the evacuation means of each system before
If the comparison function of the comparison means is disabled, the comparison function of the comparison means is enabled. The journal file management means of each system collects journal files at checkpoints appropriately set in its own system, and when a system state restoration operation is started by the dual system management means,
The system state is restored based on the journal file. In this way, it is returned to a dual system.

[0014]

FIG. 1 is a block diagram showing the configuration of a redundant computer system according to one embodiment of the present invention. The duplex computer system shown in FIG. 1 is duplicated by a first system A 1a and a second system B 1b.

Between the A-system 1a and the B-system 1b, by comparing a plurality of predetermined same types of information (control information and data) handled by these two systems 1a and 1b, A comparison circuit 2 for detecting that a failure has occurred in one of the systems and a dual system management mechanism 3 are provided.

The dual system management mechanism 3 reconfigures the system when the comparison circuit 2 detects a failure. When receiving the failure detection notification from the comparison circuit 2 via the signal line 21, the dual system management mechanism 3
The evacuation instructions 31a, 31b are given to the evacuation units 121a, 121b in the a, 12b. Further, the dual system management mechanism 3 sends the self-diagnosis results 32a, 32b from the self-diagnosis units 123a, 123b in the control units 12a, 12b.
Is received, the self-diagnosis results 32a, 32
b, the load instruction 33a for the load unit 124a in the control unit 12a, the load unit 124a in the control unit 12b.
b, or a restore instruction 3 to the journal file management mechanisms 13a, 13b described below.
4a and 34b are selectively given. When receiving the failure detection notification from the comparison circuit 2, the dual system management mechanism 3 invalidates the comparison circuit 2 via the signal line 22.

The systems 1a and 1b are composed of arithmetic units 11a and 11b,
It has controllers 12a and 12b and journal file management mechanisms 13a and 13c. Arithmetic units 11a, 11b
Are n sequential circuit elements 110-1, 110-2,.
110-n.

The sequential circuit elements 110-1 to 110-n are, for example, ASICs (application-specific ICs) to which a scan design is applied, and a sequential circuit capable of performing a scan test from the outside and a scan test of the sequential circuit. A built-in internal scan path (both not shown) forming a serial data path at the time of execution is provided. The sequential circuit elements 110-1 to 110-n are
In addition to the input / output terminals for the original operation of the sequential circuit, a serial input terminal SI for inputting serial data to an internal scan path, a serial output terminal SO for outputting serial data from the internal scan path, a scan control Control terminal C for

As is well known, a scan path (internal scan path) is a serial data path when a register (storage circuit) such as a flip-flop included in a sequential circuit is sequentially connected to form a shift register. And has a structure that does not affect the connection relationship of the original circuit. In addition, the scan test is to test a sequential circuit by serially inputting test data through a serial input terminal SI, performing scan control through a control terminal C, and examining data serially output from a serial output terminal SO. Say.

Each sequential circuit element 110-1 in the operation unit 11a
.. 110-n are connected by an external scan path 111a as a serial data path, for example, in the order of sequential circuit element 110-1, sequential circuit element 110-2,. Output terminal S
They are connected in multiple stages via O. Similarly, the operation unit 11
The sequential circuit elements 110-1 to 110-n in b are arranged by the external scan path 111b in the order of the sequential circuit element 110-1, the sequential circuit element 110-2,.
They are connected in multiple stages via the serial input terminal SI and serial output terminal SO. Further, the control terminal C of each of the sequential circuit elements 110-1 to 110-n in the operation unit 11a is connected to the control line 112a and each of the sequential circuit elements 110-1 to 110-n in the operation unit 11b.
The control terminals C of -1 to 110-n are connected to the control line 112b, respectively.

The control units 12a and 12b include a retreat unit 121
a, 121b, storage units 122a, 122b, self-diagnosis units 123a, 123b, and load units 124a, 124b.
have.

The evacuation sections 121a and 121b perform scan control via the control lines 112a and 112b when the evacuation instructions 31a and 31b are given from the dual system management mechanism 3, thereby enabling the evacuation sections 121a and 121b to operate in the operation sections 11a and 11b. The state (internal state) of the sequential circuit of each of the sequential circuit elements 110-1 to 110-n is saved via the external scan paths 111a and 111b.

The storage units 122a and 122b store the evacuation unit 12
This is for storing the internal state saved by 1a and 121b. Self-diagnosis units 123a, 123b
Performs self-diagnosis of the self-systems 1a and 1b, and notifies the dual system management mechanism 3 of the self-diagnosis results 32a and 32b.

The load sections 124a and 124b perform scan control via the control lines 112a and 112b when load instructions 33a and 33b are given from the dual system management mechanism 3, thereby storing the data in the storage sections 122a and 122b. Each sequential circuit element 110-1 in the saved operation units 11a and 11b
The states (internal states) of the sequential circuits of .about.110-n are loaded via the external scan paths 111a and 111b.

Journal file management mechanisms 13a, 13
“c” is for collecting a journal file at a checkpoint appropriately set in the systems 1a and 1b. When the restoration instructions 33a and 34b are given from the dual system management mechanism 3, the journal file management mechanisms 13a and 13b restore the system state using the journal files collected by themselves.

Next, the operation of the configuration of FIG. 1 will be described with reference to FIGS.
This will be described with reference to the flowchart of FIG. First, the A system 1a and the B system 1b in FIG. 1 perform the same operation (process) as a dual system in a normal state.

In this state, the comparison circuit 2 has been set to the valid state via the signal line 22 by the dual system management mechanism 3, and a plurality of predetermined identical types handled by the systems 1a and 1b. (Control information, data) are compared.

The comparison circuit 2 provides information (control information or data) to be compared between the A system 1a and the B system 1b.
When the inconsistency is detected, it is determined that a failure has occurred in the A system 1a or the B system 1b, and a failure detection notification is sent to the dual system management mechanism 3 via the signal line 21.

When receiving the failure detection notification from the comparison circuit 2 (step S1), the dual system management mechanism 3 disables (disables) the comparison circuit 2 (the comparison function thereof) via the signal line 22, and performs the duplex operation. The A system 1a and the B system 1b constituting the computer system can operate independently.

Further, the dual system management mechanism 3 includes both systems 1a and 1b.
Is set to the diagnostic mode, and the control units 12a, 12b of the systems 1a, 1b are set.
Evacuation instructions 31a and 31b are given to evacuation units 121a and 121b provided in 12b.

When receiving the evacuation instructions 31a and 31b, the evacuation units 121a and 121b receive the control lines 112a and 11b.
By performing scan control on (sequential circuits of) the sequential circuit elements 110-1 to 110-n in the operation units 11a and 11b via the 2b, the sequential circuit element 1 at that time is controlled.
10-1 to 110-n (sequential circuits of) (system 1a,
1b) to the external scan paths 111a, 111
b, and outputs it serially to the storage unit 122a,
An internal state saving operation for storing the data in the internal state 122b is performed (steps S2a and S2b).

When the internal state saving operation by the saving units 121a and 121b is completed, the self-diagnosis units 123a and 123b
Is started. Then, the self-diagnosis units 123a and 123b
Performs self-diagnosis in the self-systems 1a and 1b independently according to a test program (self-diagnosis program) for detecting a failure in the self-systems 1a and 1b,
It is checked whether or not a failure has occurred within 1b (steps S3a, 3b).

The self-diagnosis units 123a and 123b
Self-diagnosis results 32a, 32b performed in the own systems 1a, 1b
Is notified to the dual system management mechanism 3 (steps S4a and S4a).
b). The dual system management mechanism 3 includes the self-diagnosis units 123a and 123
When the self-diagnosis results 32a and 32b are received from 3b, the following system reconfiguration is performed based on the self-diagnosis results 32a and 32b.

First, the dual system management mechanism 3 includes the self-diagnosis unit 12
Based on the self-diagnosis results 32a and 32b from 3a and 123b, it is determined whether both A system 1a and B system 1b are normal (step S5). If the self-diagnosis result 32a,
32b indicates that both the A system 1a and the B system 1b are normal, the dual system management mechanism 3
Determines that the fault detected by the comparison circuit 2 is transient. In this case, steps S2a, S2
b, the system 1 saved by the save units 121a and 121b
The validity of the internal states of a and 1b cannot be confirmed. Therefore, the dual system management mechanism 3 sets the journal file management mechanism 13
Then, a and 13b are started, and the system states of the systems 1a and 1b are restored to the state at the latest checkpoint by the management mechanisms 13a and 13b (step S6). To restore the system state, the journal file management mechanisms 13a and 13b transfer the contents (status, memory contents, etc.) of the journal file saved (collected) at checkpoints set appropriately in the system to the statuses in the systems 1a and 1b. Write back (load) to registers, memory, etc.
This is achieved by:

Since there is no abnormality in the system, the dual system management mechanism 3 enables (enables) the comparison circuit 2 (the comparison function thereof) via the signal line 22, and duplicates the systems 1a and 1b. The operation is returned to the system, and the operation as the dual system is restarted from the restored state (step S7).

On the other hand, according to the self-diagnosis result 32a, A
If the failure of the system 1a is indicated and the self-diagnosis result 32b indicates that the system B 1b is in a normal state (steps S8 and S9), the dual system management mechanism 3 sends the system A 1a from the system. And a load instruction 33b is given to the load unit 124b.

The load section 124b receives the load instruction 33
When receiving b, the internal state of the B-system 1b (the internal state of the sequential circuits of the sequential circuit elements 110-1 to 110-n in the arithmetic unit 11b) extracted in the storage unit 122b by the save unit 121b in step S2b is extracted. Meanwhile, each of the sequential circuit elements 110-1 to 110-1 in the arithmetic unit 111b is controlled via the control line 112b.
By performing scan control on (sequential circuits of) 10-n, the extracted internal state is stored in the external scan path 111.
b, and is loaded into (sequential circuits of) the sequential circuit elements 110-1 to 110-n in the original operation unit 111b (step S10). As a result, a system including only the B system 1b is configured, and degeneration operation using only the B system 1b is started (step S11).

The self-diagnosis result 32a indicates that the A system 1a
Is in a normal state, and the self-diagnosis result 32
If the failure of the B system 1b is indicated by b (step S8), the dual system management mechanism 3 sends the failure to the B system 1b from the system.
Is disconnected, and the load instruction 33 is sent to the load unit 124a.
give a.

The load section 124a receives the load instruction 33
Upon receiving a, the internal state of the A-system 1a (the internal state of the sequential circuits of the sequential circuit elements 110-1 to 110-n in the operation unit 11a) extracted in the storage unit 122a by the save unit 121a in step S2a is extracted. Meanwhile, each of the sequential circuit elements 110-1 to 110-1 in the arithmetic unit 111a is controlled via the control line 112a.
By performing scan control on (sequential circuits of) 10-n, the extracted internal state is stored in the external scan path 111.
A serial input is performed via a, and loaded into (sequential circuits of) the sequential circuit elements 110-1 to 110-n in the original operation unit 111a (step S12). As a result, a system including only the A system 1a is configured, and a degeneration operation using only the A system 1a starts (step S12).

In the above description, when a failure is detected by the comparison circuit 2, the self-diagnosis units 123a and 123b provided in the control units 12a and 12b of the respective systems 1a and 1b perform self-diagnosis of the own systems 1a and 1b. However, each system 1a, 1b
By providing a progress status recording mechanism (progress status tracing mechanism) for recording the progress of control in the own system, it is possible to eliminate the need for self-diagnosis in the own system. This will be described below.

First, when a failure is detected by the comparison circuit 2, the evacuation instructions 31a, 31
1b, the retreating parts 121a, 121 in the same manner as in the previous embodiment.
b, the evacuation operation of steps S2a and s2b is performed, and then the restoration operation similar to that of step S6 by the journal file management mechanisms 13a and 13b is performed by the restoration instructions 34a and 34b from the dual system management mechanism 3. ,
Restart the dual processing based on the latest checkpoint journal file.

Next, when the processing in the dual system has been performed up to the failure occurrence point (time point) recorded by the progress recording mechanism, the dual system management mechanism 3 starts the operation in the dual system. The operation is stopped, and the evacuation units 121a and 121b perform the same evacuation operation as in steps S2a and s2b. Then, the internal state of the systems 1a and 1b at that time (the operation unit 11
a, 11b) are saved by the save units 121a, 121b via the external scan paths 111a, 111b and stored in the storage units 122a, 122b. Is done.

As a result, two logs of the internal state of the system A 1a at the same time are obtained in the storage unit 122a, and two logs of the internal state of the system B 1b are obtained in the storage unit 122b. That is, four logs are required for the entire system. If it is a transient fault (intermittent fault), the two logs obtained after the reprocessing match one of the two logs obtained at the time of detecting the fault. In this case, it can be determined that a temporary failure has occurred in the system corresponding to the logs that do not match. Such information
It can be used as a guide for replacing modules during maintenance.

In this system, in the case of a permanent fault, the system in which the fault has occurred cannot be specified. For this reason,
It is preferable to use in combination with the above-described embodiment in which a self-diagnosis is performed in each system.

[0045]

As described above in detail, according to the present invention, when a failure occurs in one of the systems, the system in which the failure has occurred is specified and the normal system The degenerate operation can be performed only by using. Further, according to the present invention, when a temporary failure occurs, it is possible to detect the occurrence of the transient failure and continue the operation by the dual system even though the system has a simple dual system configuration.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a redundant computer system according to one embodiment of the present invention.

FIG. 2 is a view showing part of a flowchart for explaining the operation in the embodiment.

FIG. 3 is a view showing the rest of the flowchart for explaining the operation in the embodiment.

FIG. 4 is a block diagram of a conventional computer system in which a dual system is further duplicated to achieve high reliability.

FIG. 5 is a block configuration diagram of a conventional computer system which achieves high reliability by triple operation.

[Explanation of symbols]

1a A system, 1b B system, 2 comparison circuits, 3 dual system management mechanism, 11a, 11b arithmetic unit, 12a, 12b control unit, 13a, 13b journal file management mechanism,
31a, 31b ... evacuation instruction, 32a, 32b ... self-diagnosis result, 33a, 33b ... load instruction, 34a, 34b ...
Restore instruction, 110-1 to 110-n ... sequential circuit element, 111
a, 111b ... External scan path, 112a, 112b
... Control lines, 121a and 121b ... Evacuation units, 122a and 1
22b: storage unit, 123a, 123b: self-diagnosis unit, 1
24a, 124b ... Load section.

Continued on the front page (58) Fields surveyed (Int.Cl. ⁷ , DB name) G06F 11/16-11/20 G06F 11/22 G06F 15/16-15/177 G01R 31/28

Claims (4)

(57) [Claims] 1. A sequential circuit capable of performing a scan test from the outside, and a plurality of sequential circuit elements having a built-in internal scan path forming a serial data path when performing a scan test of the sequential circuit. A plurality of sequential circuit elements having a serial input terminal for inputting serial data to the campus and a serial output terminal for outputting serial data from the internal scan path are duplicated by the first and second systems respectively mounted. In a redundant computer system in which each of the systems operates as a dual system that performs the same processing in a normal state, the serial input device is provided in each of the first and second systems, and the serial circuit element in the corresponding system is connected to the serial input device. An external scan path connected in multiple stages in a predetermined order through a terminal and a serial output terminal; Comparing means for comparing the predetermined information handled in the above to detect that one of the systems has failed; provided in the first and second systems, respectively, Evacuation means for retreating the state of the sequential circuit of each of the sequential circuit elements as the internal state of the system through the external scan path; and evacuation means provided in the first and second systems, respectively, for the corresponding system. Loading means for loading the stored internal state through the external scan path; and self-diagnosis means provided in each of the first and second systems and performing a self-diagnosis of a corresponding system after completion of the retreat operation of the retreat means. If, when a failure occurs is detected by the comparison means, the said first and second system to start the evacuation operation by the evacuation means, followed by the first and second the saving operation If one of the first and second systems is normal as a result of the self-diagnosis by the respective self-diagnosis means, the load operation by the load means on the normal system side is started, A dual computer system comprising a dual system management means for performing the degenerate operation only by the normal system. 2. A journal file provided in each of the first and second systems, collecting a journal file at a checkpoint appropriately set in the corresponding system, and restoring the system state of the corresponding system by using the journal file. The dual system management unit further comprises a self-diagnosis result of each of the self-diagnosis units of the first and second systems;
2. The system according to claim 1, wherein when both of the systems are normal, the system state restoring operation by the respective journal file management means of the first and second systems is started to return to the dual system. Redundant computer system. 3. The dual system management means includes:
When the occurrence of a fault is detected, the evacuation
When starting the operation, disable the comparison function of the comparison means
2. The dual computer system according to claim 1, wherein
Tem. 4. The apparatus according to claim 1, wherein said first and second systems are provided respectively.
Checkpoints set as appropriate in the corresponding system
Collect the journal file using the
Jar that restores the system state of the corresponding system by the file
Further comprising null file management means, wherein the dual system management means is configured to control each of the first and second systems.
As a result of the self-diagnosis by the self-diagnosis means, the first and second
If both systems are normal, the first and second systems
Of the above-mentioned journal file management means
State restoration operation and activate the comparison function of the comparison means.
4. The method according to claim 3, wherein the system is validated and returned to a dual system.
Dual computer system.